Slashdot Log In
New Developments From Microsoft Research
Posted by
Zonk
on Mon Dec 11, 2006 03:24 AM
from the end-result-of-windows-money dept.
from the end-result-of-windows-money dept.
prostoalex writes "Information Week magazine runs a brief report from Microsoft Research, showcasing some of the new technologies the company's research division is working on. Among them — a rootkit that eliminates other rootkits, a firewall that blocks the traffic exploiting published vulnerabilities, a system for catching lost e-mail, a honeypot targeted at discovering zero-day exploits, and some anti-phishing applications."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
rootkit wars (Score:5, Insightful)
Well, there goes kernel stability.
I'm really not sure I want a future Norton RootKit Protector installing itself, bugs and all, into my kernel.
Re:rootkit wars (Score:5, Funny)
Parent
Re: (Score:3, Funny)
It not only creates a seniorweb(tm) as you stated, it's also a security strategy to slow down your PC and use all available memory so you are physically unable to install malware.
Due to Moores law, Norton is required to double the memory and processor use in the same rate processors evolve, by adding *more features*.
I think they've taken the most logical course to build in this security strategy right
Re:rootkit wars (Score:5, Funny)
Parent
Re:rootkit wars (Score:5, Insightful)
Parent
Re: (Score:3, Interesting)
Re:rootkit wars (Score:5, Insightful)
Not everything from Microsoft is fucking stupid, but the comments that inevitably follow every single MS story on Slashdot are.
Parent
Re:rootkit wars (Score:4, Funny)
Parent
It is good to see (Score:4, Interesting)
Why wait? Get Snort today. (Score:3, Informative)
http://www.snort.org/ [snort.org]
Re: (Score:2)
On the other hand there is "SureMail" --> since it is some extension to reader verification will will require end to end (ALL MS i bet) support. So it will only work between 2 exchange servers. Spammers will have a field days since it verifies the email addresses that are actually read.
Re: (Score:3, Funny)
Stroller.
Re: (Score:2)
And for those who dont like to click on links, astroturfing in this sense basically means that the poster is being paid by Microsoft to appear to be 'an ordinary joe', in an attempt to create the appearance of popular low level support.
Like a politcal party activist writing letters to newspapers, pretending to be the public.
You thought you were safe! (Score:2, Funny)
Yes, but what about rootkits that eliminate rootkits that eliminate other rootkits? Muhahaha
What the ... ? Lost email? (Score:5, Insightful)
How the fuck does email get "lost"? How could that happen? Even a server crash should not cause that.
Why not, instead, spend the time and money finding the real problem in your email system and fixing that? I handle about 1,500 in-bound messages a day. By their calculations, I should be losing 15 or so, every day. Yet that does not seem to be happening.
Re: (Score:2)
Because if you fix the problem, you've fixed it. (Score:3, Insightful)
If you fix the problem of "lost" emails, then why run a system to find alert people to email that is not lost any more?
If your system is unreliable, adding complexity usually does not make it more reliable. You need to fix the problem at the lowest level possible.
Since this is Microsoft, they're probably referring to Exchange/Outlook. Exchange is mostly database driven now. If you're losing messages in your database, having someone re-send them is NOT the approach you want to take.
You have w
Re:What the ... ? Lost email? (Score:5, Funny)
You don't understand. Microsoft's email servers are more personal than BSD or Linux. Each email is hand scanned and routed. Each packet is individually inspected and if something is wrong, its routed to the appropriate supervisor. There's lots of checks and procedures. This is why Microsoft's mail servers have a more friendly user interface. You get what you pay for.
Parent
Re: (Score:3, Funny)
Yes sir! [orangecow.org] We use only the finest baby libraries, softely coded and flown from Iraq, cleansed in finest quality norton scanners, lightly killed, and then sealed in a succulent DRM quintuple secure treble virtualized rootkit envelope and lovingly compiled with visual basic.
Steve Milton Ballmer
CEO, Microsoft-Whizzo Corp.
Re: (Score:2)
Re: (Score:2)
People like claiming "I never got that e-mail" or "It must have gotten lost somewhere in the system" becase it's a easy way to get them off the hook. It's a bit like "I was writing a document yesterday and now it's gone!" (it's saved in their My Documents, they just never bothered to look). Or "My dog ate my homework".
They just probably managed to delete it without noticing or happened to filter it into some strange folder where they never check or something similarly idiotic. Problem between ch
Re: (Score:2)
For example, the design of Exchange has a ridiculously low limit on the total number of simultaneous RPC calls, but the whole system is built on COM and makes RPC calls like crazy, so when you have lots of threads and open messages and client
Re: (Score:3, Funny)
Don't worry. I'm sure that if you ask nicely, the NSA/Homeland Security will give you a copy of your email.
Again, what the ... ? (Score:2)
Yes, that was how it was designed.
And how will Microsoft know that ... without running software on my server/workstations?
Isn't there already a protocol for receiving notificat
Re:What the ... ? Lost email? (Score:5, Insightful)
The most likely causes of lost mail are stupid admins, who either don't know how to set up their mail spools, or run unreliable commercial or homebrew mail filters, in the wrong place and/or with the wrong settings.
Parent
Kernel (Score:2)
Hacks (Score:5, Funny)
Re: (Score:3, Insightful)
Norton Ghost or a "dd" solution via Linux (Score:2)
IMO that trumps the "rootkit" solution.
Microsoft research is cool (Score:3, Interesting)
In particular f# (ocaml with
Can anyone in the know comment on how doing research for a company like microsoft compares to doing CS research at a university? I'd imagine the pay would be somewhat better, but are there other tradeoffs like reduced freedom?
Re: (Score:3, Interesting)
Don't think doing CS research at uni is like a cross between having a job and being a student, because unless you are very lucky, it isn't, it fucking sucks. Its the worst of both worlds, the shittiness of it all has sucked the life and enthusiasm out of at least three of my friends.
This is just brilliant (Score:2, Funny)
So being evil installing rootkits is not enough?
One rootkit to rule them all!
Rootkit issue, not the solution (Score:2)
Re: (Score:3, Funny)
MSN Search (Score:2)
Trilion? (Score:3, Funny)
The research department is ... (Score:2, Insightful)
No Legitimate Purpose (Score:5, Insightful)
There appears to be no legitimate purpose to such research.
1. A rootkit that eliminates other rootkits can probably also be eliminated, so this research does not really solve a problem.
2. Rather than perfecting a rootkit, they should be working towards making a rootkit an impossibility in their OS.
3. If you can write a rootkit, eliminating other rootkits does not appear to be that large of a challenge in the first place.
4. If you want to eliminate a rootkit, reinstalling the OS seems like a better idea.
5. There are countless illicit uses of such software.
Are they developing this rootkit in an effort to develop new security for their OS? I don't get it.
Re:No Legitimate Purpose (Score:5, Informative)
It's closer to anti-virus than it is to a rootkit itself, though the similarities there don't go very far either. (AVs almost universally work by signature matching; GB works by comparing registry entries and files against each other by multiple means of acquiring that information in order to find the symptoms of having a rootkit -- missing information. This assumes that the rootkit is imperfect in hiding. For instance, this will do a scan of the registry through the standard API calls. But then it will parse the registry hives that are on disk. The assumption is that the rootkit is going to hook the API calls. Hooking the I/O calls is rather more difficult, and it's impossible if you can do a clean boot. (One of the options is to do a diff of a hot scan vs. a known good scan done from a Windows PE boot.) There are still things that rootkit authors can do though, specifically NOT hide from GB itself. IN the case of RootkitRevealer, this has actually turned into a mini-arms race of itself. Rootkits started not hiding from rreveal.exe or whatever it's called (so that it wouldn't detect diffs), so RootkitRevealer started randomly renaming itself each time it runs. The state of the art on the black hat side is to carry a signature of RootkitRevealer-like programs and do pattern matching in very much the same way that AV does pattern matching to find viruses.)
2. Rather than perfecting a rootkit, they should be working towards making a rootkit an impossibility in their OS.
If you can run drivers in kernel mode, you can run a rootkit. (Unless you can statically prove everything you let run in kernel space is safe... this may or may not be possible. For what it's worth, my current research is related to model checking drivers.)
Parent
Great, Just what I need (Score:2, Interesting)
Don't call stop-gap measures research ... (Score:5, Insightful)
A rootkit to destroy other rootkits... (Score:5, Insightful)
Not to mention that Vista was trumped to be the most secure, un-hackable system ever. How do you install a rootkit on it? I thought it is impossible (spare your corrections, I know it is possible no matter what. I just want to get an answer from the guys that keep telling me it is impossible to rootkit Vista).
So we're now at the "who gets deeper into the system" war. Because one thing is a given, 3 days after the MS rootkit to destroy other rootkits, the rootkit to destroy the MS rootkit is rolling out. Then it's a month 'til patchday and... you know the drill, we already live it.
There is no technical solution to social problems. As long as people are dumb enough to click everything offered to them while they're running on admin or root privileges, those things will exist and they will work. Now, with Vista finally trying to run on low privileges, the social engineering part will become bigger to get the user to grant more privileges when necessary for the bug to survive, but since pretty much EVERY program will need those for installation, people will hand out those privileges like freebies, because it's customary that a new program needs them.
Microsoft (Research) Acquires new tecnology! (Score:4, Informative)
Simply not true!
I mean, since it is the Exact description of how RootkitRevealer works, I suppose (I'm sure) that it is the same product. For those who do not know,Microsoft acquired sysinternals (maker of RootkitRevealer) a few months ago.
Oh, and talking 'bout honeypots (Score:5, Interesting)
Even "detecting" pots that simulate a user's behaviour and look actively for forged sites and such are getting out of usefulness, since a lot of distributors already start hardening their attacks against aggressive farming. Or they require you to go through very detailed steps that a bot cannot reproduce. I've recently had my first captcha-protected exploit (was a porn site, and what user wouldn't solve a captcha to get his pic when he surfed there just for that in the first place?).
Forget honeypots. Unless you put a human behind that VM it's running on. Automated pots are becoming less and less useful with attackers becoming more and more aware of them. Especially you can dump any kind of "honeypot kit", they are known and their quirks are tested painstakingly before an attack takes place.
Re: (Score:3, Interesting)
Cool. How can I get my machine on those lists?
Seriously, this means that an IP range can be "poisoned" by hosting honeypots amid the the real machines in it. And if not, you don't lose either - you have a working honeypot.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2, Interesting)
MSR has been working on GhostBuster [microsoft.com] for some time, with a white paper released July 2004. That MSR site says that RootkitRevealer was released Feb 22, 2005. This fact is confirmed by archive.org, where the version archived Feb 22 does not contain RR and the one from Feb 23 does. (Not to mention the front page [archive.org] listed it as Feb 22.)
Re: (Score:3, Funny)
So wait, is Microsoft supposed to be the young fit men hunting ghosts or the large, bloated Stay-Puft Marshmallow Man that's unhealthy for the public?